Resource exhaustion in Zulip
CVE-2026-97701
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (37.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Zulip — versions < 12.2
Weakness classification (CWE)
References
- github.com/zulip/zulip/commit/31773c77c501391ede0fa8ec727f39508664e0ae
- github.com/zulip/zulip/commit/4d94dd2ee6337a4b3351694dd314a45d3fe11031
- github.com/zulip/zulip/pull/39913
- github.com/zulip/zulip/releases/tag/12.2
- github.com/zulip/zulip/security/advisories/GHSA-m257-w4r5-5rmf
- zulip.readthedocs.io/en/latest/overview/changelog.html
Frequently asked questions
- What is CVE-2026-97701?
- CVE-2026-97701 is a medium-severity vulnerability in Zulip, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.5/10. Published 2026-11-04.
- How severe is CVE-2026-97701?
- Medium severity. CVSS v3 base score is 6.5 out of 10.